Spam 419/Nigeria Online fraud jwSpamSpy Contact
Email Spam Filter: |
|
|
Fraudulent Job offer: Advertising International Company (AIC)
- Job offer spam: Forwarding payments (Fraud)
- Fraudulent job offers: alpenantique.com
- Fraudulent job offers: lionder.org
- Forwarding Paypal payments via Western Union (Fraud)
The "Advertising International Company" job offer is part of a series of scams designed to trick third parties into assisting the criminal laundering of stolen money. It has similarities to the alpenantique.com spam.
See more about this type of scam here:
Here is the message:
Advertising International Company
More than 7 years of successful working in the market of advertising services
Looking for a perspective and well-paid job
in the Germany?
Check up our site for the further information
Click here (once)
Here are the message headers:
Received: from 217.252.115.9 (HELO pD9FC7309.dip.t-dialin.net) (217.252.115.9)
by mta120.mail.dcn.yahoo.com with SMTP; Tue, 16 Nov 2004 12:26:09 -0800
Received: from a-i-c-d.org (mail.a-i-c-d.org [222.223.128.38])
by pD9FC7309.dip.t-dialin.net (Postfix) with ESMTP id 6EFEFEEDC0
for <ourname@ourdomain>; Tue, 16 Nov 2004 16:23:22 -0500
Reply-To:
From: "Caroms R. Svelter" <aichner@a-i-c-d.org>
To: Ourname <ourname@ourdomain>
Subject: FREE Work from Home ! lFAKTQv3ptNgAh
Date: Tue, 16 Nov 2004 16:23:22 -0500
Message-ID: <110001c4cc22$0b388789$b881f0dd@a-i-c-d.org>
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.2616
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1082
X-AntiVirus: skaner antywirusowy poczty Wirtualnej Polski S. A.
Notes:
- Why is this job offer sent to a total stranger about whom the company knows nothing?
- Why is the mail sent directly from a dialup address using "ratware" (special spam sending software that claims it's Outlook Express?
- Why is there no postal address, telephone number of fax number in the email?
- The company's domain (a-i-c-d.org) was only registered 17 days ago (2004-10-30), two days after the lionder.org fake job offer website. That's a bit recent for a seven year old company.
- The registration details from the WHOIS record are completely phony.
This is a similar scam to the "Plasma project, Inc.", "Alpen-Antique GmbH" and Lionder.org job scams.
As we recently found out, the objective of the "Alpen-Antique GmbH" fraud was to trick people into making money stolen from hacked bank accounts untraceable by receiving it in their own account, withdrawing it in cash and then forwarding it via Western Union. Most likely, "AIC" will steal money from hacked German bank accounts in the near future and is looking for people to unwittingly assist them. Quite possibly organized crime from Eastern Europe is behind this scam: Lionder.org posed as a Lithuanian company, "Alpen-Antique GmbH" supplied an Estonian name for the wire transfer recipient and "AIC" claims to run billboards in Russia.
As with the "Plasma project, Inc." and "Alpen-Antique GmbH" scams, the fraudulent website is based on the site of a legitimate company. The fraudulent website keeps getting recycled under new names. In this case, the original legitimate company is Lamar Advertising Company in the US.
Compare the original:
Currently, Lamar operates more than 149,000 billboards and more than 97,500 logo sign displays across the country. In addition, Lamar has 40 transit advertising franchises that reach driving audiences in 16 states through displays on bus shelters, benches and buses.
with these rip-offs:
Currently, MAIC operates more than 147,000 billboards and more than 90,000 logo sign displays across the country. In addition, MAIC has 40 transit advertising franchises that reach driving audiences in 16 states through displays on bus shelters, benches and buses.
Currently, DTC operates more than 147,000 billboards and more than 90,000 logo sign displays across the country. In addition, DTC has 40 transit advertising franchises that reach driving audiences in 16 states through displays on bus shelters, benches and buses.
Currently, AIC operates more than 147,000 billboards and more than 90,000 logo sign displays across the country. In addition, AIC has 40 transit advertising franchises that reach driving audiences in 16 states through displays on bus shelters, benches and buses.
WHOIS record for a-i-c-d.org
"Advertising International Company (AIC) continued: a-i-k.com
WHOIS details for domain "a-i-k.com"
Anti-Spam Resources:
Clueless virus filters spam innocent third parties
Domain ID:D105067383-LROR
Domain Name:A-I-C-D.ORG
Created On:30-Oct-2004 19:07:40 UTC
Last Updated On:30-Oct-2004 19:08:41 UTC
Expiration Date:30-Oct-2005 19:07:40 UTC
Sponsoring Registrar:Bizcn.com, Inc. (R1248-LROR)
Status:TRANSFER PROHIBITED
Registrant ID:orggg99163262238
Registrant Name:guo guo
Registrant Organization:guo
Registrant Street1:Shanghai China
Registrant Street2:
Registrant Street3:
Registrant City:Shang Hai
Registrant State/Province:Shang Hai
Registrant Postal Code:200001
Registrant Country:CN
Registrant Phone:+86.59222222222
Registrant Phone Ext.:
Registrant FAX:+86.59222222222
Registrant FAX Ext.:
Registrant Email:112244@126.com
Admin ID:orggg99163262575
Admin Name:guo guo
Admin Organization:guo
Admin Street1:Shanghai China
Admin Street2:
Admin Street3:
Admin City:Shang Hai
Admin State/Province:Shang Hai
Admin Postal Code:200001
Admin Country:CN
Admin Phone:+86.59222222222
Admin Phone Ext.:
Admin FAX:+86.59222222222
Admin FAX Ext.:
Admin Email:112244@126.com
Tech ID:orggg99163262888
Tech Name:guo guo
Tech Organization:guo guo
Tech Street1:Shanghai China
Tech Street2:
Tech Street3:
Tech City:Shang Hai
Tech State/Province:Shang Hai
Tech Postal Code:200001
Tech Country:CN
Tech Phone:+86.59222222222
Tech Phone Ext.:
Tech FAX:+86.59222222222
Tech FAX Ext.:
Tech Email:112244@126.com
Name Server:NS1.ROTDNS.BIZ
Name Server:NS2.ROTDNS.BIZ
"a-i-k.com" uses the same website as the "a-i-c-d.org" scam, but a different domain. It looks like the criminals will be targetting accounts at several Spanish banks:
Perspective work in Spain for all comers to have good money!
Our company requires employees able to receive our clients' remittances in Spain . For doing it you should open an account at one of the following banks: www.cajamadrid.es, www.kutxa.es, www.cajamar.es, www.banesto.es and inform us the account data.
After that our clients make remittances to your account. You get the money and send them by Western Union to our company
(you'll be informed of the account data after the transmission)
What's your profit?
You will get 7% commission from each remittance. Since all remittances will be about eur.3500, your profit will be up to eur.250.
Domain Name: a-i-k.com
Registrant Contact:
Martha Poyatos an1555672@hotmail.com
Martha Poyatos
735 -17th Avenue
Menlo Park, CA 94025
US
+1.6503277451
Administrative Contact:
Martha Poyatos an1555672@hotmail.com
Martha Poyatos
735 -17th Avenue
Menlo Park, CA 94025
US
+1.6503277451
Technical Contact:
Martha Poyatos an1555672@hotmail.com
Martha Poyatos
735 -17th Avenue
Menlo Park, CA 94025
US
+1.6503277451
Billing Contact:
Martha Poyatos an1555672@hotmail.com
Martha Poyatos
735 -17th Avenue
Menlo Park, CA 94025
US
+1.6503277451
Record created on 2005-02-04 15:53:19.
Record expires on 2006-02-04 15:53:19.
Domain servers in listed order:
ns1.vhosted.biz
ns2.vhosted.biz
jwSpamSpy is our spam filter (free evaluation version available for download)
Anti-spam domain blacklist – list of domains that I refuse to receive mail from
Recent additions to domain blacklist (with whois details)
"419" scam sender/contact addresses ("Nigeria connection" address book)
DNS-based IP and domain name blacklists
IP address ranges
Dynamic IP addresses (700 KB!)
Name server / Registrar combinations
Free email providers
AOL dial-up address ranges and mail servers
How to trace senders of spam
Frequently asked questions (FAQ)
Lookup an IP address on blacklists (http://dnsbl.net.au/lookup/)
Challenge and Response spam filters: A selfish idea for selfish times
ShareYourExperiences.com spammers
Smyrnagroup spammers (in German)
Kaplan College spam
Stock Price Manipulation Spam ("Pump & Dump")
What's the deal with "OEM software"?
'Phishing' for your wallet
Job spam for payment processors
Spam phone numbers ("diploma" spam, etc.)
"Joe job" information
Link exchange offer spam
Getting creative with spam
Link exchange spam: allcarpictures.com
Xenophobia, Spam and Viruses: The "German Spam" (Sober.H)
Sober.H – Racist German email spam spread by virus (in German)
"Joe job" against joewein.de
Porn spam: watchsound.com
Porn spam: hotsalza.com
Name servers used by spammers: joker.com
Rogue name servers: mediadreamland.com
Rogue name servers: airmaramba.biz
Rogue name servers: bonafidecash.com
Rogue name servers: maileasy.biz